Skip to content

Guard against overflow on exclusive IP range bounds - #3250

Open
arpitjain099 wants to merge 1 commit into
quickwit-oss:mainfrom
arpitjain099:fix/ip-range-exclusive-bound-overflow
Open

arpitjain099 wants to merge 1 commit into
quickwit-oss:mainfrom
arpitjain099:fix/ip-range-exclusive-bound-overflow

Conversation

@arpitjain099

Copy link
Copy Markdown

bound_range_inclusive_ip converts an exclusive bound to an inclusive one with a plain + 1 and - 1 on the u128 address, so excluding the first or last representable address overflows. Release builds leave overflow checks off, so the add wraps and the range inverts: a query for addresses strictly above ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff became the full range and matched every document in my test index instead of none. Under cargo test, where [profile.test] sets overflow-checks = true, the same query panics in the scorer.

The numeric sibling just below already returns None for this case through checked_add and checked_sub, so I did the same and let the weight fall through to EmptyScorer.

bound_range_inclusive_ip converted an exclusive bound with a raw +1 and -1
on the u128 address. Excluding the first or last representable address
overflowed: a panic under overflow checks, and a wrap to the full range
otherwise. Return None for that case, as the numeric sibling already does,
so the weight falls through to EmptyScorer.

Generated with Claude Opus 5.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 7, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-07T20:10:18.477357Z 941503d PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant